Multimedia Integrated Business Display System
Monthly
SQL injection in Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System 8.2.2 allows remote attackers to manipulate backend database queries via the Structure_ID parameter in an admin-facing JSP endpoint. The CVSS 4.0 vector (PR:N/UI:N) indicates no authentication or user interaction is required, though the /admin/ path prefix creates meaningful uncertainty about whether access controls exist that were not reflected in the scoring. A public POC has been released and linked from the VulDB submission, lowering the bar for exploitation. No vendor-issued patch has been identified at time of analysis.
SQL injection in Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System 8.2.2 allows remote attackers to manipulate backend database queries via the Structure_ID parameter in an admin-facing JSP endpoint. The CVSS 4.0 vector (PR:N/UI:N) indicates no authentication or user interaction is required, though the /admin/ path prefix creates meaningful uncertainty about whether access controls exist that were not reflected in the scoring. A public POC has been released and linked from the VulDB submission, lowering the bar for exploitation. No vendor-issued patch has been identified at time of analysis.